An eavesdropping tool allegedly used by the German government to intercept Skype calls is full of security problems and may violate a ruling by the country's constitutional court, according to a European hacker club. The information was released as part of a move towards financial transparency. The government released figures of expenses incurred by the Federal Ministry of the Interior following a parliamentary inquiry.
This raises a whole lot of ethical and privacy questions. It has long been rumored that the German government was interested in developing an application to intercept Skype. Three years ago, documents released by WikiLeaks purported to show a proposal by a Bavarian company, DigiTask, offering to develop such a tool.
The Chaos Computer Club obtained several versions of a program that has allegedly been used by German law enforcement in possibly hundreds of investigations to intercept Skype calls, said Frank Rieger, a member of the club. On page 34 and page 37 of the report the cost for decoding software for Google Mail, MSN Hotmail, Yahoo Mail for prevention and investigation was listed.
In 2009, for instance the German police rented hardware and software to monitor Skype for almost A!30,400 (about US$39,300) from the German company DigiTask. DigiTask also provided software to decode Google Mail (as Gmail was formerly called in Germany,) MSN Hotmail and Yahoo Mail, according to the documents. The software was ordered twice for approximately A!12,500.
"Not only can unauthorized third parties assume control of the infected system, but even attackers of mediocre skill level can connect to the authorities, claim to be a specific instance of the trojan and upload fake data," according to the Chaos Computer Club's writeup.
The Chaos Computer Club provided samples to F-Secure, which found Quellen-TKU also had keylogging capabilities to intercept data entered into applications such as Firefox, and the instant messaging programs MSN Messenger and ICQ.
Tapping a phone is acceptable in today's democracy because there are procedures in place for that sort of surveillance, But we are sort of sleep walking quietly from one level to the next.
Subscribe to our Daily News-letter via email - Be First to know about Security and Hackers.
Subscribe to our Daily News-letter via email - Be First to know about Security and Hackers.
